LDAP-Monitor 1.0.0__tar.gz → 2.0.0__tar.gz

{ldap_monitor-1.0.0 → ldap_monitor-2.0.0}/LDAP_Monitor.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: LDAP-Monitor
-Version: 1.0.0
+Version: 2.0.0
 Summary: Monitor LDAP directory changes in real-time
 Home-page: https://github.com/MegaManSec/LDAP-Monitoring-Watchdog
 Author: Joshua Rogers
@@ -9,9 +9,6 @@ License: GPL-3.0
 Project-URL: Blog Post, https://joshua.hu/ldap-watchdog-openldap-python-monitoring-tool-realtime-directory-slack-notifications
 Project-URL: Author, https://joshua.hu/
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.7
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -20,12 +17,13 @@ Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
 Classifier: Operating System :: OS Independent
 Classifier: Topic :: System :: Monitoring
 Classifier: Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP
-Requires-Python: >=3.7
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: ldap3
+Requires-Dist: pyasn1>=0.6.4
 Provides-Extra: slack
-Requires-Dist: requests; extra == "slack"
+Requires-Dist: requests>=2.33.0; extra == "slack"
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier
@@ -66,15 +64,15 @@ Previously named LDAP-Stalker (because monitoring changes of an LDAP directory i
 
 ## Examples (No Filtering)
 
-Note: in the below examples, entryCSN and modifyTimestamp can be completely ignored by setting `LDAP_WATCHDOG_IGNORED_ATTRIBUTES=entryCSN,modifyTimestamp`.
+Note: in the below examples, changes to entryCSN and modifyTimestamp on existing entries can be ignored by setting `LDAP_WATCHDOG_IGNORED_ATTRIBUTES=entryCSN,modifyTimestamp`.
 
 ### Terminal (with color) output:
 
-![Example of the output from LDAP Watchdog](example.png "LDAP Watchdog")
+![Example of the output from LDAP Watchdog](https://raw.githubusercontent.com/MegaManSec/LDAP-Monitoring-Watchdog/main/example.png "LDAP Watchdog")
 
 ### Slack output:
 
-![Example of the output from LDAP Watchdog in Slack](example-slack.png "LDAP Watchdog")
+![Example of the output from LDAP Watchdog in Slack](https://raw.githubusercontent.com/MegaManSec/LDAP-Monitoring-Watchdog/main/example-slack.png "LDAP Watchdog")
 
 ## Features
 
@@ -90,13 +88,13 @@ Note: in the below examples, entryCSN and modifyTimestamp can be completely igno
 
 6.  **Customizable Output:** Console output provides clear and colored indications of additions, modifications, and deletions for easy visibility.
 
-7.  **Ignored Entries and Attributes:** Users can specify UUIDs and attributes to be ignored during the comparison process.
+7.  **Ignored Entries and Attributes:** Users can specify UUIDs and attributes to ignore when comparing changes to existing entries.
 
 8.  **Conditional Ignored Attributes:** Conditional filtering allows users to ignore specific attributes based on change type (additions, modifications, deletions).
 
 
 ## Requirements
-- Python 3.7+.
+- Python 3.10+.
 - The `ldap3` package. If using a Slack webhook, the `requests` package is also required.
 
 ## Installation
@@ -166,10 +164,10 @@ docker run -d \
 
 ### Systemd Installation (Debian-based)
 
-A Debian-based installation script, [install.sh](install.sh), is provided. When run as root, this script:
+A Debian-based installation script, [install.sh](https://github.com/MegaManSec/LDAP-Monitoring-Watchdog/blob/main/install.sh), is provided. When run as root from a clone of this repository, this script:
 
 1. Creates (if necessary) a Python virtual environment in `/opt/ldap-watchdog`.
-2. Installs LDAP Watchdog from PyPI into that virtual environment.
+2. Installs LDAP Watchdog from the clone into that virtual environment, with the dependency versions pinned in `requirements.txt`.
 3. Creates an environment file at `/etc/ldap-watchdog.env` for configuration.
 4. Installs and enables a systemd service (`/etc/systemd/system/ldap-watchdog.service`) that runs **ldap-watchdog** in the background.
 5. Configures logging to `/var/log/ldap-watchdog.log` and `/var/log/ldap-watchdog-error.log`.
@@ -200,17 +198,24 @@ All configuration is done via environment variables. The following variables are
 | `LDAP_WATCHDOG_USERNAME` | LDAP username for authentication. Leave empty for anonymous bind. | `""` |
 | `LDAP_WATCHDOG_PASSWORD` | LDAP password for authentication. Leave empty for anonymous bind. | `""` |
 | `LDAP_WATCHDOG_USE_SSL` | Set to `true` to use SSL, `false` otherwise | `true` |
+| `LDAP_WATCHDOG_CA_CERTS_FILE` | Optional PEM CA bundle for verifying the LDAP server certificate. If unset, system trust roots are used. | Unset |
+| `LDAP_WATCHDOG_TLS_VERIFY` | Set to `false` to skip verifying the LDAP server certificate and host name. The connection is still encrypted but not authenticated. | `true` |
 | `LDAP_WATCHDOG_SEARCH_FILTER` | LDAP filter for user and group entries | `(&(|(objectClass=inetOrgPerson)(objectClass=groupOfNames)))` |
-| `LDAP_WATCHDOG_SEARCH_ATTRIBUTE` | Comma-separated list of attributes to retrieve. [`*,+`](https://joshua.hu/tracking-secret-ldap-login-times-with-modifytimestamp-heuristics) is used by default to include operational attributes. | `*,+` |
+| `LDAP_WATCHDOG_SEARCH_ATTRIBUTE` | Comma-separated list of attributes to retrieve. [`*,+`](https://joshua.hu/tracking-secret-ldap-login-times-with-modifytimestamp-heuristics) is used by default to include operational attributes. `entryUUID` is always requested and must be readable for every entry. | `*,+` |
 | `LDAP_WATCHDOG_REFRESH_RATE` | Time interval in seconds between consecutive LDAP searches | `60` |
+| `LDAP_WATCHDOG_NETWORK_TIMEOUT` | Positive integer timeout in seconds for LDAP and Slack connection/read operations. This limits individual waits, not the total duration of a poll. | `30` |
 | `LDAP_WATCHDOG_DISABLE_COLOR_OUTPUT` | Set to `true` to disable colored terminal output | `false` |
 
+LDAPS connections verify the server certificate and check that it is valid for the host name or IP address in `LDAP_WATCHDOG_SERVER`. For a private CA, set `LDAP_WATCHDOG_CA_CERTS_FILE` to a readable PEM CA bundle; in Docker, mount the bundle into the container and use its container path. A self-signed server certificate can be used as the bundle itself. If the certificate can't be provided or doesn't match the server's name, `LDAP_WATCHDOG_TLS_VERIFY=false` turns verification off; anyone on the network path can then impersonate the server and capture the bind password. For a server without TLS, use an `ldap://` URL or set `LDAP_WATCHDOG_USE_SSL=false`.
+
 ### Control User
 
 | Environment Variable | Description | Default |
 |---|---|---|
 | `LDAP_WATCHDOG_CONTROL_UUID` | UUID of a control user whose changes trigger an error if not found. If set, this user should always have some type of change when the LDAP directory is retrieved. | `""` |
-| `LDAP_WATCHDOG_CONTROL_USER_ATTRIBUTE` | Specific attribute to check for changes in the control user. If set, this attribute _must_ have changed for the control UUID user. | `""` |
+| `LDAP_WATCHDOG_CONTROL_USER_ATTRIBUTE` | Specific attribute to check in the control user. If set, it must exist in both snapshots and its value must differ. | `""` |
+
+A failed control check logs an error and skips that comparison. The next poll compares against the most recent successfully retrieved snapshot; changes from a rejected comparison are not replayed. A failed LDAP retrieval instead preserves the previous snapshot and is retried on the next poll. Failure to retrieve the initial snapshot stops the process.
 
 ### Slack Integration
 
@@ -219,12 +224,16 @@ All configuration is done via environment variables. The following variables are
 | `SLACK_WEBHOOK_URL` | Slack Webhook URL for notifications. Requires the `slack` extra (`pip install LDAP-Monitor[slack]`). | `None` |
 | `LDAP_WATCHDOG_SLACK_BULLETPOINT` | Bullet point character used in Slack and console output | ` \u2022   ` |
 
+Slack delivery is best effort: HTTP and network failures are logged to stderr, and monitoring and console output continue. Failed notifications are not queued or retried.
+
 ### Ignored Entries and Attributes
 
+These filters apply to attribute changes on entries present in both snapshots. Entry additions and deletions are always announced with all retrieved attributes, including for ignored UUIDs.
+
 | Environment Variable | Description | Default |
 |---|---|---|
-| `LDAP_WATCHDOG_IGNORED_UUIDS` | Comma-separated list of UUIDs to ignore during comparison | `""` |
-| `LDAP_WATCHDOG_IGNORED_ATTRIBUTES` | Comma-separated list of attributes to ignore during comparison | `""` |
+| `LDAP_WATCHDOG_IGNORED_UUIDS` | Comma-separated list of UUIDs whose attribute changes are ignored | `""` |
+| `LDAP_WATCHDOG_IGNORED_ATTRIBUTES` | Comma-separated list of attributes whose changes are ignored on existing entries | `""` |
 | `LDAP_WATCHDOG_CONDITIONAL_IGNORED_ATTRIBUTES` | JSON string of attributes to conditionally ignore (see below) | `{}` |
 
 ### Conditional Ignored Attributes
@@ -248,7 +257,9 @@ export LDAP_WATCHDOG_BASE_DN='dc=mouse,dc=com'
 export LDAP_WATCHDOG_USERNAME='Emily'
 export LDAP_WATCHDOG_PASSWORD='qwerty123'
 export LDAP_WATCHDOG_USE_SSL='true'
+export LDAP_WATCHDOG_TLS_VERIFY='true'
 export LDAP_WATCHDOG_REFRESH_RATE='60'
+export LDAP_WATCHDOG_NETWORK_TIMEOUT='30'
 export LDAP_WATCHDOG_DISABLE_COLOR_OUTPUT='false'
 export LDAP_WATCHDOG_IGNORED_UUIDS='e191c564-6e6d-42c1-ae51-bda0509fe846,8655e0d9-ecdc-46ce-ba42-1fa3dfbf5faa'
 export LDAP_WATCHDOG_IGNORED_ATTRIBUTES='modifyTimestamp,phoneNumber,officeLocation,gecos'
@@ -263,5 +274,16 @@ ldap-watchdog
 2. Similar to #1, there is no real way to determine whether a change is really a change in some cases, or a removal and then addition in the same time. In theory, it doesn't really matter, however it's important to note.
 
 
+## Development
+
+Install the package with Slack support and run the regression tests:
+
+```bash
+pip install ".[slack]"
+python -m unittest discover -s tests
+```
+
+`requirements.txt` pins every dependency for the Docker image and `install.sh`. After changing the dependencies in `setup.py`, regenerate it with `pip-compile --extra=slack --output-file=requirements.txt setup.py`.
+
 ## License
-This project is licensed under [GPL3.0](/LICENSE).
+This project is licensed under [GPL3.0](https://github.com/MegaManSec/LDAP-Monitoring-Watchdog/blob/main/LICENSE).

{ldap_monitor-1.0.0 → ldap_monitor-2.0.0}/LDAP_Monitor.egg-info/SOURCES.txt

@@ -11,4 +11,5 @@ LDAP_Monitor.egg-info/top_level.txt
 ldap_watchdog/__init__.py
 ldap_watchdog/__main__.py
 ldap_watchdog/config.py
-ldap_watchdog/watchdog.py
+ldap_watchdog/watchdog.py
+tests/test_watchdog.py

ldap_monitor-2.0.0/LDAP_Monitor.egg-info/requires.txt

@@ -0,0 +1,5 @@
+ldap3
+pyasn1>=0.6.4
+
+[slack]
+requests>=2.33.0

{ldap_monitor-1.0.0 → ldap_monitor-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: LDAP-Monitor
-Version: 1.0.0
+Version: 2.0.0
 Summary: Monitor LDAP directory changes in real-time
 Home-page: https://github.com/MegaManSec/LDAP-Monitoring-Watchdog
 Author: Joshua Rogers
@@ -9,9 +9,6 @@ License: GPL-3.0
 Project-URL: Blog Post, https://joshua.hu/ldap-watchdog-openldap-python-monitoring-tool-realtime-directory-slack-notifications
 Project-URL: Author, https://joshua.hu/
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.7
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -20,12 +17,13 @@ Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
 Classifier: Operating System :: OS Independent
 Classifier: Topic :: System :: Monitoring
 Classifier: Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP
-Requires-Python: >=3.7
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: ldap3
+Requires-Dist: pyasn1>=0.6.4
 Provides-Extra: slack
-Requires-Dist: requests; extra == "slack"
+Requires-Dist: requests>=2.33.0; extra == "slack"
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier
@@ -66,15 +64,15 @@ Previously named LDAP-Stalker (because monitoring changes of an LDAP directory i
 
 ## Examples (No Filtering)
 
-Note: in the below examples, entryCSN and modifyTimestamp can be completely ignored by setting `LDAP_WATCHDOG_IGNORED_ATTRIBUTES=entryCSN,modifyTimestamp`.
+Note: in the below examples, changes to entryCSN and modifyTimestamp on existing entries can be ignored by setting `LDAP_WATCHDOG_IGNORED_ATTRIBUTES=entryCSN,modifyTimestamp`.
 
 ### Terminal (with color) output:
 
-![Example of the output from LDAP Watchdog](example.png "LDAP Watchdog")
+![Example of the output from LDAP Watchdog](https://raw.githubusercontent.com/MegaManSec/LDAP-Monitoring-Watchdog/main/example.png "LDAP Watchdog")
 
 ### Slack output:
 
-![Example of the output from LDAP Watchdog in Slack](example-slack.png "LDAP Watchdog")
+![Example of the output from LDAP Watchdog in Slack](https://raw.githubusercontent.com/MegaManSec/LDAP-Monitoring-Watchdog/main/example-slack.png "LDAP Watchdog")
 
 ## Features
 
@@ -90,13 +88,13 @@ Note: in the below examples, entryCSN and modifyTimestamp can be completely igno
 
 6.  **Customizable Output:** Console output provides clear and colored indications of additions, modifications, and deletions for easy visibility.
 
-7.  **Ignored Entries and Attributes:** Users can specify UUIDs and attributes to be ignored during the comparison process.
+7.  **Ignored Entries and Attributes:** Users can specify UUIDs and attributes to ignore when comparing changes to existing entries.
 
 8.  **Conditional Ignored Attributes:** Conditional filtering allows users to ignore specific attributes based on change type (additions, modifications, deletions).
 
 
 ## Requirements
-- Python 3.7+.
+- Python 3.10+.
 - The `ldap3` package. If using a Slack webhook, the `requests` package is also required.
 
 ## Installation
@@ -166,10 +164,10 @@ docker run -d \
 
 ### Systemd Installation (Debian-based)
 
-A Debian-based installation script, [install.sh](install.sh), is provided. When run as root, this script:
+A Debian-based installation script, [install.sh](https://github.com/MegaManSec/LDAP-Monitoring-Watchdog/blob/main/install.sh), is provided. When run as root from a clone of this repository, this script:
 
 1. Creates (if necessary) a Python virtual environment in `/opt/ldap-watchdog`.
-2. Installs LDAP Watchdog from PyPI into that virtual environment.
+2. Installs LDAP Watchdog from the clone into that virtual environment, with the dependency versions pinned in `requirements.txt`.
 3. Creates an environment file at `/etc/ldap-watchdog.env` for configuration.
 4. Installs and enables a systemd service (`/etc/systemd/system/ldap-watchdog.service`) that runs **ldap-watchdog** in the background.
 5. Configures logging to `/var/log/ldap-watchdog.log` and `/var/log/ldap-watchdog-error.log`.
@@ -200,17 +198,24 @@ All configuration is done via environment variables. The following variables are
 | `LDAP_WATCHDOG_USERNAME` | LDAP username for authentication. Leave empty for anonymous bind. | `""` |
 | `LDAP_WATCHDOG_PASSWORD` | LDAP password for authentication. Leave empty for anonymous bind. | `""` |
 | `LDAP_WATCHDOG_USE_SSL` | Set to `true` to use SSL, `false` otherwise | `true` |
+| `LDAP_WATCHDOG_CA_CERTS_FILE` | Optional PEM CA bundle for verifying the LDAP server certificate. If unset, system trust roots are used. | Unset |
+| `LDAP_WATCHDOG_TLS_VERIFY` | Set to `false` to skip verifying the LDAP server certificate and host name. The connection is still encrypted but not authenticated. | `true` |
 | `LDAP_WATCHDOG_SEARCH_FILTER` | LDAP filter for user and group entries | `(&(|(objectClass=inetOrgPerson)(objectClass=groupOfNames)))` |
-| `LDAP_WATCHDOG_SEARCH_ATTRIBUTE` | Comma-separated list of attributes to retrieve. [`*,+`](https://joshua.hu/tracking-secret-ldap-login-times-with-modifytimestamp-heuristics) is used by default to include operational attributes. | `*,+` |
+| `LDAP_WATCHDOG_SEARCH_ATTRIBUTE` | Comma-separated list of attributes to retrieve. [`*,+`](https://joshua.hu/tracking-secret-ldap-login-times-with-modifytimestamp-heuristics) is used by default to include operational attributes. `entryUUID` is always requested and must be readable for every entry. | `*,+` |
 | `LDAP_WATCHDOG_REFRESH_RATE` | Time interval in seconds between consecutive LDAP searches | `60` |
+| `LDAP_WATCHDOG_NETWORK_TIMEOUT` | Positive integer timeout in seconds for LDAP and Slack connection/read operations. This limits individual waits, not the total duration of a poll. | `30` |
 | `LDAP_WATCHDOG_DISABLE_COLOR_OUTPUT` | Set to `true` to disable colored terminal output | `false` |
 
+LDAPS connections verify the server certificate and check that it is valid for the host name or IP address in `LDAP_WATCHDOG_SERVER`. For a private CA, set `LDAP_WATCHDOG_CA_CERTS_FILE` to a readable PEM CA bundle; in Docker, mount the bundle into the container and use its container path. A self-signed server certificate can be used as the bundle itself. If the certificate can't be provided or doesn't match the server's name, `LDAP_WATCHDOG_TLS_VERIFY=false` turns verification off; anyone on the network path can then impersonate the server and capture the bind password. For a server without TLS, use an `ldap://` URL or set `LDAP_WATCHDOG_USE_SSL=false`.
+
 ### Control User
 
 | Environment Variable | Description | Default |
 |---|---|---|
 | `LDAP_WATCHDOG_CONTROL_UUID` | UUID of a control user whose changes trigger an error if not found. If set, this user should always have some type of change when the LDAP directory is retrieved. | `""` |
-| `LDAP_WATCHDOG_CONTROL_USER_ATTRIBUTE` | Specific attribute to check for changes in the control user. If set, this attribute _must_ have changed for the control UUID user. | `""` |
+| `LDAP_WATCHDOG_CONTROL_USER_ATTRIBUTE` | Specific attribute to check in the control user. If set, it must exist in both snapshots and its value must differ. | `""` |
+
+A failed control check logs an error and skips that comparison. The next poll compares against the most recent successfully retrieved snapshot; changes from a rejected comparison are not replayed. A failed LDAP retrieval instead preserves the previous snapshot and is retried on the next poll. Failure to retrieve the initial snapshot stops the process.
 
 ### Slack Integration
 
@@ -219,12 +224,16 @@ All configuration is done via environment variables. The following variables are
 | `SLACK_WEBHOOK_URL` | Slack Webhook URL for notifications. Requires the `slack` extra (`pip install LDAP-Monitor[slack]`). | `None` |
 | `LDAP_WATCHDOG_SLACK_BULLETPOINT` | Bullet point character used in Slack and console output | ` \u2022   ` |
 
+Slack delivery is best effort: HTTP and network failures are logged to stderr, and monitoring and console output continue. Failed notifications are not queued or retried.
+
 ### Ignored Entries and Attributes
 
+These filters apply to attribute changes on entries present in both snapshots. Entry additions and deletions are always announced with all retrieved attributes, including for ignored UUIDs.
+
 | Environment Variable | Description | Default |
 |---|---|---|
-| `LDAP_WATCHDOG_IGNORED_UUIDS` | Comma-separated list of UUIDs to ignore during comparison | `""` |
-| `LDAP_WATCHDOG_IGNORED_ATTRIBUTES` | Comma-separated list of attributes to ignore during comparison | `""` |
+| `LDAP_WATCHDOG_IGNORED_UUIDS` | Comma-separated list of UUIDs whose attribute changes are ignored | `""` |
+| `LDAP_WATCHDOG_IGNORED_ATTRIBUTES` | Comma-separated list of attributes whose changes are ignored on existing entries | `""` |
 | `LDAP_WATCHDOG_CONDITIONAL_IGNORED_ATTRIBUTES` | JSON string of attributes to conditionally ignore (see below) | `{}` |
 
 ### Conditional Ignored Attributes
@@ -248,7 +257,9 @@ export LDAP_WATCHDOG_BASE_DN='dc=mouse,dc=com'
 export LDAP_WATCHDOG_USERNAME='Emily'
 export LDAP_WATCHDOG_PASSWORD='qwerty123'
 export LDAP_WATCHDOG_USE_SSL='true'
+export LDAP_WATCHDOG_TLS_VERIFY='true'
 export LDAP_WATCHDOG_REFRESH_RATE='60'
+export LDAP_WATCHDOG_NETWORK_TIMEOUT='30'
 export LDAP_WATCHDOG_DISABLE_COLOR_OUTPUT='false'
 export LDAP_WATCHDOG_IGNORED_UUIDS='e191c564-6e6d-42c1-ae51-bda0509fe846,8655e0d9-ecdc-46ce-ba42-1fa3dfbf5faa'
 export LDAP_WATCHDOG_IGNORED_ATTRIBUTES='modifyTimestamp,phoneNumber,officeLocation,gecos'
@@ -263,5 +274,16 @@ ldap-watchdog
 2. Similar to #1, there is no real way to determine whether a change is really a change in some cases, or a removal and then addition in the same time. In theory, it doesn't really matter, however it's important to note.
 
 
+## Development
+
+Install the package with Slack support and run the regression tests:
+
+```bash
+pip install ".[slack]"
+python -m unittest discover -s tests
+```
+
+`requirements.txt` pins every dependency for the Docker image and `install.sh`. After changing the dependencies in `setup.py`, regenerate it with `pip-compile --extra=slack --output-file=requirements.txt setup.py`.
+
 ## License
-This project is licensed under [GPL3.0](/LICENSE).
+This project is licensed under [GPL3.0](https://github.com/MegaManSec/LDAP-Monitoring-Watchdog/blob/main/LICENSE).

{ldap_monitor-1.0.0 → ldap_monitor-2.0.0}/README.md

@@ -24,15 +24,15 @@ Previously named LDAP-Stalker (because monitoring changes of an LDAP directory i
 
 ## Examples (No Filtering)
 
-Note: in the below examples, entryCSN and modifyTimestamp can be completely ignored by setting `LDAP_WATCHDOG_IGNORED_ATTRIBUTES=entryCSN,modifyTimestamp`.
+Note: in the below examples, changes to entryCSN and modifyTimestamp on existing entries can be ignored by setting `LDAP_WATCHDOG_IGNORED_ATTRIBUTES=entryCSN,modifyTimestamp`.
 
 ### Terminal (with color) output:
 
-![Example of the output from LDAP Watchdog](example.png "LDAP Watchdog")
+![Example of the output from LDAP Watchdog](https://raw.githubusercontent.com/MegaManSec/LDAP-Monitoring-Watchdog/main/example.png "LDAP Watchdog")
 
 ### Slack output:
 
-![Example of the output from LDAP Watchdog in Slack](example-slack.png "LDAP Watchdog")
+![Example of the output from LDAP Watchdog in Slack](https://raw.githubusercontent.com/MegaManSec/LDAP-Monitoring-Watchdog/main/example-slack.png "LDAP Watchdog")
 
 ## Features
 
@@ -48,13 +48,13 @@ Note: in the below examples, entryCSN and modifyTimestamp can be completely igno
 
 6.  **Customizable Output:** Console output provides clear and colored indications of additions, modifications, and deletions for easy visibility.
 
-7.  **Ignored Entries and Attributes:** Users can specify UUIDs and attributes to be ignored during the comparison process.
+7.  **Ignored Entries and Attributes:** Users can specify UUIDs and attributes to ignore when comparing changes to existing entries.
 
 8.  **Conditional Ignored Attributes:** Conditional filtering allows users to ignore specific attributes based on change type (additions, modifications, deletions).
 
 
 ## Requirements
-- Python 3.7+.
+- Python 3.10+.
 - The `ldap3` package. If using a Slack webhook, the `requests` package is also required.
 
 ## Installation
@@ -124,10 +124,10 @@ docker run -d \
 
 ### Systemd Installation (Debian-based)
 
-A Debian-based installation script, [install.sh](install.sh), is provided. When run as root, this script:
+A Debian-based installation script, [install.sh](https://github.com/MegaManSec/LDAP-Monitoring-Watchdog/blob/main/install.sh), is provided. When run as root from a clone of this repository, this script:
 
 1. Creates (if necessary) a Python virtual environment in `/opt/ldap-watchdog`.
-2. Installs LDAP Watchdog from PyPI into that virtual environment.
+2. Installs LDAP Watchdog from the clone into that virtual environment, with the dependency versions pinned in `requirements.txt`.
 3. Creates an environment file at `/etc/ldap-watchdog.env` for configuration.
 4. Installs and enables a systemd service (`/etc/systemd/system/ldap-watchdog.service`) that runs **ldap-watchdog** in the background.
 5. Configures logging to `/var/log/ldap-watchdog.log` and `/var/log/ldap-watchdog-error.log`.
@@ -158,17 +158,24 @@ All configuration is done via environment variables. The following variables are
 | `LDAP_WATCHDOG_USERNAME` | LDAP username for authentication. Leave empty for anonymous bind. | `""` |
 | `LDAP_WATCHDOG_PASSWORD` | LDAP password for authentication. Leave empty for anonymous bind. | `""` |
 | `LDAP_WATCHDOG_USE_SSL` | Set to `true` to use SSL, `false` otherwise | `true` |
+| `LDAP_WATCHDOG_CA_CERTS_FILE` | Optional PEM CA bundle for verifying the LDAP server certificate. If unset, system trust roots are used. | Unset |
+| `LDAP_WATCHDOG_TLS_VERIFY` | Set to `false` to skip verifying the LDAP server certificate and host name. The connection is still encrypted but not authenticated. | `true` |
 | `LDAP_WATCHDOG_SEARCH_FILTER` | LDAP filter for user and group entries | `(&(|(objectClass=inetOrgPerson)(objectClass=groupOfNames)))` |
-| `LDAP_WATCHDOG_SEARCH_ATTRIBUTE` | Comma-separated list of attributes to retrieve. [`*,+`](https://joshua.hu/tracking-secret-ldap-login-times-with-modifytimestamp-heuristics) is used by default to include operational attributes. | `*,+` |
+| `LDAP_WATCHDOG_SEARCH_ATTRIBUTE` | Comma-separated list of attributes to retrieve. [`*,+`](https://joshua.hu/tracking-secret-ldap-login-times-with-modifytimestamp-heuristics) is used by default to include operational attributes. `entryUUID` is always requested and must be readable for every entry. | `*,+` |
 | `LDAP_WATCHDOG_REFRESH_RATE` | Time interval in seconds between consecutive LDAP searches | `60` |
+| `LDAP_WATCHDOG_NETWORK_TIMEOUT` | Positive integer timeout in seconds for LDAP and Slack connection/read operations. This limits individual waits, not the total duration of a poll. | `30` |
 | `LDAP_WATCHDOG_DISABLE_COLOR_OUTPUT` | Set to `true` to disable colored terminal output | `false` |
 
+LDAPS connections verify the server certificate and check that it is valid for the host name or IP address in `LDAP_WATCHDOG_SERVER`. For a private CA, set `LDAP_WATCHDOG_CA_CERTS_FILE` to a readable PEM CA bundle; in Docker, mount the bundle into the container and use its container path. A self-signed server certificate can be used as the bundle itself. If the certificate can't be provided or doesn't match the server's name, `LDAP_WATCHDOG_TLS_VERIFY=false` turns verification off; anyone on the network path can then impersonate the server and capture the bind password. For a server without TLS, use an `ldap://` URL or set `LDAP_WATCHDOG_USE_SSL=false`.
+
 ### Control User
 
 | Environment Variable | Description | Default |
 |---|---|---|
 | `LDAP_WATCHDOG_CONTROL_UUID` | UUID of a control user whose changes trigger an error if not found. If set, this user should always have some type of change when the LDAP directory is retrieved. | `""` |
-| `LDAP_WATCHDOG_CONTROL_USER_ATTRIBUTE` | Specific attribute to check for changes in the control user. If set, this attribute _must_ have changed for the control UUID user. | `""` |
+| `LDAP_WATCHDOG_CONTROL_USER_ATTRIBUTE` | Specific attribute to check in the control user. If set, it must exist in both snapshots and its value must differ. | `""` |
+
+A failed control check logs an error and skips that comparison. The next poll compares against the most recent successfully retrieved snapshot; changes from a rejected comparison are not replayed. A failed LDAP retrieval instead preserves the previous snapshot and is retried on the next poll. Failure to retrieve the initial snapshot stops the process.
 
 ### Slack Integration
 
@@ -177,12 +184,16 @@ All configuration is done via environment variables. The following variables are
 | `SLACK_WEBHOOK_URL` | Slack Webhook URL for notifications. Requires the `slack` extra (`pip install LDAP-Monitor[slack]`). | `None` |
 | `LDAP_WATCHDOG_SLACK_BULLETPOINT` | Bullet point character used in Slack and console output | ` \u2022   ` |
 
+Slack delivery is best effort: HTTP and network failures are logged to stderr, and monitoring and console output continue. Failed notifications are not queued or retried.
+
 ### Ignored Entries and Attributes
 
+These filters apply to attribute changes on entries present in both snapshots. Entry additions and deletions are always announced with all retrieved attributes, including for ignored UUIDs.
+
 | Environment Variable | Description | Default |
 |---|---|---|
-| `LDAP_WATCHDOG_IGNORED_UUIDS` | Comma-separated list of UUIDs to ignore during comparison | `""` |
-| `LDAP_WATCHDOG_IGNORED_ATTRIBUTES` | Comma-separated list of attributes to ignore during comparison | `""` |
+| `LDAP_WATCHDOG_IGNORED_UUIDS` | Comma-separated list of UUIDs whose attribute changes are ignored | `""` |
+| `LDAP_WATCHDOG_IGNORED_ATTRIBUTES` | Comma-separated list of attributes whose changes are ignored on existing entries | `""` |
 | `LDAP_WATCHDOG_CONDITIONAL_IGNORED_ATTRIBUTES` | JSON string of attributes to conditionally ignore (see below) | `{}` |
 
 ### Conditional Ignored Attributes
@@ -206,7 +217,9 @@ export LDAP_WATCHDOG_BASE_DN='dc=mouse,dc=com'
 export LDAP_WATCHDOG_USERNAME='Emily'
 export LDAP_WATCHDOG_PASSWORD='qwerty123'
 export LDAP_WATCHDOG_USE_SSL='true'
+export LDAP_WATCHDOG_TLS_VERIFY='true'
 export LDAP_WATCHDOG_REFRESH_RATE='60'
+export LDAP_WATCHDOG_NETWORK_TIMEOUT='30'
 export LDAP_WATCHDOG_DISABLE_COLOR_OUTPUT='false'
 export LDAP_WATCHDOG_IGNORED_UUIDS='e191c564-6e6d-42c1-ae51-bda0509fe846,8655e0d9-ecdc-46ce-ba42-1fa3dfbf5faa'
 export LDAP_WATCHDOG_IGNORED_ATTRIBUTES='modifyTimestamp,phoneNumber,officeLocation,gecos'
@@ -221,5 +234,16 @@ ldap-watchdog
 2. Similar to #1, there is no real way to determine whether a change is really a change in some cases, or a removal and then addition in the same time. In theory, it doesn't really matter, however it's important to note.
 
 
+## Development
+
+Install the package with Slack support and run the regression tests:
+
+```bash
+pip install ".[slack]"
+python -m unittest discover -s tests
+```
+
+`requirements.txt` pins every dependency for the Docker image and `install.sh`. After changing the dependencies in `setup.py`, regenerate it with `pip-compile --extra=slack --output-file=requirements.txt setup.py`.
+
 ## License
-This project is licensed under [GPL3.0](/LICENSE).
+This project is licensed under [GPL3.0](https://github.com/MegaManSec/LDAP-Monitoring-Watchdog/blob/main/LICENSE).

{ldap_monitor-1.0.0 → ldap_monitor-2.0.0}/ldap_watchdog/__init__.py

@@ -1,2 +1,2 @@
 """LDAP Watchdog - Monitor LDAP directory changes in real-time."""
-__version__ = "1.0.0"
+__version__ = "2.0.0"

{ldap_monitor-1.0.0 → ldap_monitor-2.0.0}/ldap_watchdog/config.py

@@ -28,6 +28,8 @@ LDAP_SERVER = os.getenv('LDAP_WATCHDOG_SERVER', '')
 LDAP_USERNAME = os.getenv('LDAP_WATCHDOG_USERNAME', '')
 LDAP_PASSWORD = os.getenv('LDAP_WATCHDOG_PASSWORD', '')
 LDAP_USE_SSL = _parse_bool(os.getenv('LDAP_WATCHDOG_USE_SSL', 'true'))
+LDAP_CA_CERTS_FILE = os.getenv('LDAP_WATCHDOG_CA_CERTS_FILE') or None
+LDAP_TLS_VERIFY = _parse_bool(os.getenv('LDAP_WATCHDOG_TLS_VERIFY', 'true'))
 BASE_DN = os.getenv('LDAP_WATCHDOG_BASE_DN', '')
 
 DISABLE_COLOR_OUTPUT = _parse_bool(os.getenv('LDAP_WATCHDOG_DISABLE_COLOR_OUTPUT', 'false'))
@@ -36,6 +38,9 @@ SEARCH_FILTER = os.getenv('LDAP_WATCHDOG_SEARCH_FILTER', '(&(|(objectClass=inetO
 SEARCH_ATTRIBUTE = _parse_list(os.getenv('LDAP_WATCHDOG_SEARCH_ATTRIBUTE', '*,+'))
 
 REFRESH_RATE = int(os.getenv('LDAP_WATCHDOG_REFRESH_RATE', '60'))
+NETWORK_TIMEOUT = int(os.getenv('LDAP_WATCHDOG_NETWORK_TIMEOUT', '30'))
+if NETWORK_TIMEOUT <= 0:
+    raise ValueError('LDAP_WATCHDOG_NETWORK_TIMEOUT must be greater than zero')
 
 SLACK_BULLETPOINT = os.getenv('LDAP_WATCHDOG_SLACK_BULLETPOINT', ' \u2022   ')
 

{ldap_monitor-1.0.0 → ldap_monitor-2.0.0}/ldap_watchdog/watchdog.py

@@ -4,12 +4,15 @@
 # Licensed under the GPL3.0 License.  You should have received a copy of the GNU General Public License along with LDAP Watchdog. If not, see <https://www.gnu.org/licenses/>.
 
 import json
+import re
+import ssl
 import sys
+from collections import Counter
 from datetime import datetime
 import time
 
-from ldap3 import Server, Connection, ALL, SUBTREE
-from ldap3.core.exceptions import LDAPSocketOpenError
+from ldap3 import Server, Connection, Tls, ALL, SUBTREE
+from ldap3.core.exceptions import LDAPException
 
 from ldap_watchdog import config
 
@@ -32,6 +35,19 @@ def col(op_type):
     return {'add': "\033[1m\033[32m", 'delete': "\033[3m\033[31m", 'modify': "\033[33m"}[op_type]
 
 
+class VerifiedTls(Tls):
+    """
+    ldap3 TLS settings that verify the server certificate and hostname with the ssl module's default context.
+    """
+
+    def wrap_socket(self, connection, do_handshake=False):
+        context = ssl.create_default_context(cafile=self.ca_certs_file)
+        context.verify_flags &= ~ssl.VERIFY_X509_STRICT
+        connection.socket = context.wrap_socket(
+            connection.socket, server_hostname=connection.server.host, do_handshake_on_connect=do_handshake,
+        )
+
+
 def retrieve_ldap():
     """
     Connects to the LDAP server and retrieves LDAP entries.
@@ -40,33 +56,57 @@ def retrieve_ldap():
     - dict: Dictionary containing LDAP entries.
     """
     entries = {}
-    server = Server(config.LDAP_SERVER, use_ssl=config.LDAP_USE_SSL, get_info=ALL)
+    if config.LDAP_TLS_VERIFY:
+        tls = VerifiedTls(validate=ssl.CERT_REQUIRED, ca_certs_file=config.LDAP_CA_CERTS_FILE)
+    else:
+        tls = Tls(validate=ssl.CERT_NONE)
+    server = Server(
+        config.LDAP_SERVER, use_ssl=config.LDAP_USE_SSL, get_info=ALL,
+        tls=tls, connect_timeout=config.NETWORK_TIMEOUT,
+    )
     if config.LDAP_USERNAME and config.LDAP_PASSWORD:
-        conn = Connection(server, user=config.LDAP_USERNAME, password=config.LDAP_PASSWORD)
-        if not conn.bind():
-            print('Error in bind:', conn.result, file=sys.stderr)
-            return entries
+        conn = Connection(server, user=config.LDAP_USERNAME, password=config.LDAP_PASSWORD,
+                          receive_timeout=config.NETWORK_TIMEOUT)
     else:
-        conn = Connection(server)
-        if not conn.bind():
-            print('Anonymous bind failed:', conn.result, file=sys.stderr)
-            return entries
-
-    conn.search(search_base=config.BASE_DN, search_filter=config.SEARCH_FILTER, search_scope=SUBTREE, attributes=config.SEARCH_ATTRIBUTE)
-
-    for entry in conn.entries:
-        entry = json.loads(entry.entry_to_json())
-        entry_dict = entry['attributes']
-        for attr_name, attr_value in entry_dict.items():
-            attr_value = attr_value[0]
-            # Some entries may be encoded using base64 and provided by a dictionary.
-            # In that case, replace the dictionary with a string of the encoded data.
-            if isinstance(attr_value, dict) and len(attr_value) == 2 and 'encoded' in attr_value and 'encoding' in attr_value and attr_value['encoding'] == 'base64':
-                decoded_value = attr_value['encoded']
-                entry_dict[attr_name] = decoded_value
+        conn = Connection(server, receive_timeout=config.NETWORK_TIMEOUT)
 
-        entry_dict['dn'] = [entry['dn']]
-        entries[entry_dict['entryUUID'][0]] = entry_dict
+    try:
+        if not conn.bind():
+            raise LDAPException(f"LDAP bind failed: {conn.result}")
+
+        cookie = None
+        while True:
+            conn.search(
+                search_base=config.BASE_DN, search_filter=config.SEARCH_FILTER,
+                search_scope=SUBTREE, attributes=config.SEARCH_ATTRIBUTE + ['entryUUID'],
+                paged_size=500, paged_cookie=cookie,
+            )
+            # A successful search can return no entries; check the result code.
+            if conn.result['result'] != 0:
+                raise LDAPException(f"LDAP search failed: {conn.result}")
+
+            for entry in conn.entries:
+                entry = json.loads(entry.entry_to_json())
+                entry_dict = entry['attributes']
+                for attr_name, values in entry_dict.items():
+                    # Keep every value, including binary data represented as Base64 by ldap3.
+                    entry_dict[attr_name] = [
+                        value['encoded']
+                        if isinstance(value, dict) and value.get('encoding') == 'base64'
+                        else value
+                        for value in values
+                    ]
+
+                entry_dict['dn'] = [entry['dn']]
+                if not entry_dict.get('entryUUID'):
+                    raise LDAPException(f"LDAP entry {entry['dn']} has no readable entryUUID")
+                entries[entry_dict['entryUUID'][0]] = entry_dict
+
+            cookie = conn.result.get('controls', {}).get('1.2.840.113556.1.4.319', {}).get('value', {}).get('cookie')
+            if not cookie:
+                break
+    finally:
+        conn.unbind()
 
     return entries
 
@@ -138,8 +178,8 @@ def announce(dn_uuid, op_type, changes):
     - None
     """
     slack_msg, print_msg = generate_message(dn_uuid, op_type, changes)
+    print(print_msg, flush=True)
     send_to_slack(slack_msg)
-    print(print_msg)
 
 
 def truncate_slack_message(message):
@@ -152,10 +192,23 @@ def truncate_slack_message(message):
     Returns:
     - str: Truncated Slack message.
     """
-    while len(message) > 4000:
-        longest_word = max(message.split(), key=len)
-        message = message.replace(longest_word, "[...truncated...]")
+    marker = "[...truncated...]"
+    header, newline, _ = message.partition("\n")
+    protected = set(header.split()) if newline else set()
+    words = Counter(message.split())
+    length = len(message)
+    replaced = set()
+    for word in sorted(words, key=len, reverse=True):
+        if length <= 4000 or len(word) <= len(marker):
+            break
+        if word in protected:
+            continue
+        replaced.add(word)
+        length -= words[word] * (len(word) - len(marker))
 
+    message = re.sub(r'\S+', lambda match: marker if match.group() in replaced else match.group(), message)
+    if len(message) > 4000:
+        return message[:4000 - len(marker)] + marker
     return message
 
 
@@ -174,9 +227,13 @@ def send_to_slack(message):
 
     message = truncate_slack_message(message)
 
-    headers = {'Content-type': 'application/json'}
-    data = {'text': message}
-    requests.post(config.SLACK_WEBHOOK, headers=headers, data=json.dumps(data))
+    try:
+        response = requests.post(config.SLACK_WEBHOOK, json={'text': message}, timeout=config.NETWORK_TIMEOUT)
+        response.raise_for_status()
+    except requests.RequestException as e:
+        # Exception messages can contain the secret webhook URL.
+        detail = f"HTTP {e.response.status_code}" if e.response is not None else type(e).__name__
+        print(f"Slack notification failed: {detail}", file=sys.stderr)
 
 
 def check_control_user(old_entries, new_entries):
@@ -253,10 +310,10 @@ def compare_ldap_entries(old_entries, new_entries):
                 if old_value != new_value:
                     if old_value is None:
                         # If the key is not found in old_entries, it's an addition.
-                        changes["additions"].append({key: new_value})
+                        changes["additions"].append({key: list(new_value)})
                     elif new_value is None:
                         # If the key is not found in new_entries, it's a removal.
-                        changes["removals"].append({key: old_value})
+                        changes["removals"].append({key: list(old_value)})
                     else:
                         # If the key is in both old_entries and new_entries but the values are not the same, then may be a modification.
                         # There is no way to truly determine whether an attribute's value(s) have been changed, or removed and then a new value added.
@@ -310,7 +367,7 @@ def compare_ldap_entries(old_entries, new_entries):
                                     print(f"Ignoring {change_type} of {old_entries[uuid]['dn'][0]} ({old_entries[uuid]['entryUUID'][0]}) {ignored_attr_name}: from {old_attr_value} to {new_attr_value}", file=sys.stderr)
                                     changes[change_type].remove(change) # Remove the whole dictionary from changes["modifications"].
                             else:
-                                for added_or_removed_val in change[ignored_attr_name][:]: # val1, val2, ...
+                                for added_or_removed_val in change[ignored_attr_name].copy(): # val1, val2, ...
                                     if added_or_removed_val in ignored_attr_list: # Check whether the value should be ignored.
                                         print(f"Ignoring {change_type} of {old_entries[uuid]['dn'][0]} ({old_entries[uuid]['entryUUID'][0]}) {ignored_attr_name}: {added_or_removed_val}", file=sys.stderr)
                                         change[ignored_attr_name].remove(added_or_removed_val) # Remove the ignored value from the set of added/removed attributes for attribute ignored_attr_name.
@@ -330,8 +387,8 @@ def main():
 
         try:
             retrieved_entries = retrieve_ldap()
-        except LDAPSocketOpenError as e:
-            print(f"LDAP connection error: {e}", file=sys.stderr)
+        except LDAPException as e:
+            print(f"LDAP retrieval error: {e}", file=sys.stderr)
             continue
 
         old_entries = new_entries

{ldap_monitor-1.0.0 → ldap_monitor-2.0.0}/setup.py

@@ -22,12 +22,13 @@ setup(
     },
     license="GPL-3.0",
     packages=find_packages(),
-    python_requires=">=3.7",
+    python_requires=">=3.10",
     install_requires=[
         "ldap3",
+        "pyasn1>=0.6.4",
     ],
     extras_require={
-        "slack": ["requests"],
+        "slack": ["requests>=2.33.0"],
     },
     entry_points={
         "console_scripts": [
@@ -36,9 +37,6 @@ setup(
     },
     classifiers=[
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.7",
-        "Programming Language :: Python :: 3.8",
-        "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
         "Programming Language :: Python :: 3.12",

ldap_monitor-2.0.0/tests/test_watchdog.py

@@ -0,0 +1,325 @@
+import copy
+import io
+import json
+import os
+import socket
+import ssl
+import threading
+import time
+import unittest
+from contextlib import redirect_stderr, redirect_stdout
+from unittest.mock import Mock, patch
+
+from ldap3 import Connection, MOCK_SYNC, OFFLINE_SLAPD_2_4, Server
+from ldap3.core.exceptions import LDAPException, LDAPSocketReceiveError
+import requests
+
+from ldap_watchdog import config, watchdog
+
+
+UUID = '11111111-1111-1111-1111-111111111111'
+DN = 'cn=Alice,dc=example,dc=com'
+CERTS = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'certs')
+
+
+def snapshot(**attributes):
+    return {UUID: dict(entryUUID=[UUID], dn=[DN], cn=['Alice'], **attributes)}
+
+
+class ComparisonTests(unittest.TestCase):
+    def setUp(self):
+        settings = patch.multiple(
+            config, CONTROL_UUID='', IGNORED_UUIDS=[], IGNORED_ATTRIBUTES=[],
+            CONDITIONAL_IGNORED_ATTRIBUTES={'memberOf': ['ignored']},
+        )
+        settings.start()
+        self.addCleanup(settings.stop)
+
+    def test_conditional_filter_preserves_unignored_multivalued_changes(self):
+        for change_type, old, new in (
+            ('additions', ['existing'], ['existing', 'ignored', 'important']),
+            ('removals', ['existing', 'ignored', 'important'], ['existing']),
+        ):
+            with self.subTest(change_type=change_type):
+                with patch.object(watchdog, 'announce') as announce, redirect_stderr(io.StringIO()):
+                    watchdog.compare_ldap_entries(snapshot(memberOf=old), snapshot(memberOf=new))
+                announce.assert_called_once()
+                self.assertEqual(announce.call_args[0][2][change_type], [{'memberOf': {'important'}}])
+
+    def test_conditional_filter_suppresses_only_ignored_changes(self):
+        with patch.object(watchdog, 'announce') as announce, redirect_stderr(io.StringIO()):
+            watchdog.compare_ldap_entries(
+                snapshot(memberOf=['existing']), snapshot(memberOf=['existing', 'ignored']),
+            )
+        announce.assert_not_called()
+
+    def test_conditional_filter_leaves_snapshots_unchanged(self):
+        for change_type, old, new in (
+            ('additions', snapshot(), snapshot(memberOf=['ignored', 'important'])),
+            ('removals', snapshot(memberOf=['ignored', 'important']), snapshot()),
+        ):
+            with self.subTest(change_type=change_type):
+                expected = copy.deepcopy((old, new))
+                with patch.object(watchdog, 'announce') as announce, redirect_stderr(io.StringIO()):
+                    watchdog.compare_ldap_entries(old, new)
+                self.assertEqual(announce.call_args[0][2][change_type], [{'memberOf': ['important']}])
+                self.assertEqual((old, new), expected)
+
+
+class MessageTests(unittest.TestCase):
+    def test_short_messages_are_unchanged(self):
+        for message in ('', 'hello', 'x' * 4000):
+            self.assertEqual(watchdog.truncate_slack_message(message), message)
+
+    def test_truncation_handles_many_short_words_and_whitespace(self):
+        group_message, _ = watchdog.generate_message(DN, 'add', {
+            'member': [f'uid=user{i},ou=People,dc=example,dc=com' for i in range(100)],
+        })
+        for message in ('word ' * 1000, ' ' * 5000, group_message):
+            with self.subTest(length=len(message)):
+                truncated = watchdog.truncate_slack_message(message)
+                self.assertLessEqual(len(truncated), 4000)
+                self.assertIn('[...truncated...]', truncated)
+
+    def test_truncation_preserves_text_after_a_large_value(self):
+        message = 'photo ' + 'x' * 5000 + ' important change'
+        self.assertEqual(
+            watchdog.truncate_slack_message(message),
+            'photo [...truncated...] important change',
+        )
+
+    def test_truncation_keeps_the_changed_entry_in_the_header(self):
+        for op_type in ('add', 'delete'):
+            message, _ = watchdog.generate_message(DN, op_type, {
+                'member': [f'uid=user{i},ou=People,dc=example,dc=com' for i in range(100)],
+            })
+            with self.subTest(op_type=op_type):
+                header = message.partition('\n')[0]
+                self.assertIn(DN, header)
+                self.assertEqual(watchdog.truncate_slack_message(message).partition('\n')[0], header)
+
+    def test_truncation_replaces_the_longest_words_first(self):
+        for words, expected in (
+            (['b' * 2500, 'a' * 2500, 'c' * 100], ['[...truncated...]', 'a' * 2500, 'c' * 100]),
+            (['x' * 2000, 'y' * 600, 'x' * 2000, 'z' * 20], ['[...truncated...]', 'y' * 600, '[...truncated...]', 'z' * 20]),
+        ):
+            with self.subTest(words=[len(word) for word in words]):
+                self.assertEqual(watchdog.truncate_slack_message(' '.join(words)), ' '.join(expected))
+
+    def test_truncation_of_large_groups_is_fast(self):
+        message, _ = watchdog.generate_message(DN, 'delete', {
+            'member': [f'uid=user{i:06d},ou=People,dc=example,dc=com' for i in range(8000)],
+        })
+        start = time.perf_counter()
+        truncated = watchdog.truncate_slack_message(message)
+        self.assertLess(time.perf_counter() - start, 1)
+        self.assertEqual(len(truncated), 4000)
+
+
+class RetrievalTests(unittest.TestCase):
+    def setUp(self):
+        settings = patch.multiple(
+            config, LDAP_SERVER='mock', LDAP_USERNAME='', LDAP_PASSWORD='',
+            BASE_DN='dc=example,dc=com', SEARCH_FILTER='(objectClass=inetOrgPerson)',
+            SEARCH_ATTRIBUTE=['*', '+'], CONTROL_UUID='', IGNORED_UUIDS=[],
+            IGNORED_ATTRIBUTES=[], CONDITIONAL_IGNORED_ATTRIBUTES={},
+        )
+        settings.start()
+        self.addCleanup(settings.stop)
+
+    def retrieve(self, **attributes):
+        connection = Connection(Server('mock', get_info=OFFLINE_SLAPD_2_4), client_strategy=MOCK_SYNC)
+        entry = dict(
+            objectClass=['inetOrgPerson'], cn=['Alice'], sn=['Example'],
+            entryUUID=[UUID],
+        )
+        entry.update(attributes)
+        connection.strategy.add_entry(DN, entry)
+        with patch.object(watchdog, 'Server'), patch.object(watchdog, 'Connection', return_value=connection):
+            return watchdog.retrieve_ldap()
+
+    def test_absent_requested_attribute_is_empty(self):
+        config.SEARCH_ATTRIBUTE = ['cn', 'mail', 'entryUUID']
+        self.assertEqual(self.retrieve()[UUID]['mail'], [])
+
+    def test_uuid_is_retrieved_with_custom_attribute_selection(self):
+        config.SEARCH_ATTRIBUTE = ['cn']
+        self.assertEqual(self.retrieve()[UUID]['entryUUID'], [UUID])
+        self.assertEqual(config.SEARCH_ATTRIBUTE, ['cn'])
+
+    def test_missing_uuid_rejects_the_snapshot(self):
+        with self.assertRaisesRegex(LDAPException, 'no readable entryUUID'):
+            self.retrieve(entryUUID=[])
+
+    def test_all_binary_values_are_preserved(self):
+        entry = self.retrieve(jpegPhoto=[b'\xff\x00', b'\x03\xfc'])[UUID]
+        self.assertEqual(entry['jpegPhoto'], ['/wA=', 'A/w='])
+
+    def test_binary_changes_compare_whole_values(self):
+        old = self.retrieve(jpegPhoto=[b'\xff\x00'])
+        new = self.retrieve(jpegPhoto=[b'\x03\xfc'])
+        with patch.object(watchdog, 'announce') as announce:
+            watchdog.compare_ldap_entries(old, new)
+        announce.assert_called_once()
+        self.assertEqual(announce.call_args[0][2]['modifications'], [{'jpegPhoto': ('/wA=', 'A/w=')}])
+
+
+class SnapshotTests(unittest.TestCase):
+    def setUp(self):
+        self.connection = Mock()
+        self.connection.bind.return_value = True
+        self.connection.result = {'result': 0}
+        self.connection.entries = []
+        for patcher in (
+            patch.object(watchdog, 'Server'),
+            patch.object(watchdog, 'Connection', return_value=self.connection),
+        ):
+            patcher.start()
+            self.addCleanup(patcher.stop)
+
+    def test_failed_bind_is_not_an_empty_snapshot(self):
+        self.connection.bind.return_value = False
+        self.connection.result = {'result': 49, 'description': 'invalidCredentials'}
+        with self.assertRaisesRegex(LDAPException, 'bind failed'):
+            watchdog.retrieve_ldap()
+        self.connection.unbind.assert_called_once()
+
+    def test_successful_empty_search_is_a_valid_snapshot(self):
+        self.connection.search.return_value = False
+        self.assertEqual(watchdog.retrieve_ldap(), {})
+        self.connection.unbind.assert_called_once()
+
+    def set_page(self, uuid, cookie, result=0):
+        self.connection.entries = [Mock(entry_to_json=Mock(return_value=json.dumps({
+            'dn': DN, 'attributes': {'entryUUID': [uuid]},
+        })))]
+        self.connection.result = {
+            'result': result,
+            'controls': {'1.2.840.113556.1.4.319': {'value': {'cookie': cookie}}},
+        }
+
+    def test_all_pages_are_retrieved(self):
+        pages = iter([(UUID, b'next'), ('second', b'')])
+        self.connection.search.side_effect = lambda **kwargs: self.set_page(*next(pages))
+        self.assertEqual(set(watchdog.retrieve_ldap()), {UUID, 'second'})
+        calls = self.connection.search.call_args_list
+        self.assertEqual([call[1]['paged_cookie'] for call in calls], [None, b'next'])
+        self.connection.unbind.assert_called_once()
+
+    def test_later_page_failure_rejects_the_entire_snapshot(self):
+        pages = iter([(UUID, b'next', 0), ('second', b'', 4)])
+        self.connection.search.side_effect = lambda **kwargs: self.set_page(*next(pages))
+        with self.assertRaisesRegex(LDAPException, 'search failed'):
+            watchdog.retrieve_ldap()
+        self.connection.unbind.assert_called_once()
+
+    def test_failed_poll_preserves_the_last_successful_snapshot(self):
+        old = snapshot(title=['old'])
+        new = snapshot(title=['new'])
+        for error in (LDAPException('search failed'), LDAPSocketReceiveError('disconnected')):
+            with self.subTest(error=type(error).__name__):
+                with patch.object(watchdog, 'retrieve_ldap', side_effect=[old, error, new]), \
+                        patch.object(watchdog.time, 'sleep', side_effect=[None, None, KeyboardInterrupt]), \
+                        patch.object(watchdog, 'compare_ldap_entries') as compare, \
+                        redirect_stderr(io.StringIO()):
+                    with self.assertRaises(KeyboardInterrupt):
+                        watchdog.main()
+                compare.assert_called_once_with(old, new)
+
+
+class TLSTests(unittest.TestCase):
+    def test_ldaps_requires_a_trusted_certificate(self):
+        connection = Mock()
+        connection.bind.return_value = False
+        with patch.multiple(config, LDAP_SERVER='ldaps://localhost', LDAP_CA_CERTS_FILE=None), \
+                patch.object(watchdog, 'Connection', return_value=connection) as factory:
+            with self.assertRaises(LDAPException):
+                watchdog.retrieve_ldap()
+        server = factory.call_args[0][0]
+        self.assertTrue(server.ssl)
+        self.assertEqual(server.tls.validate, ssl.CERT_REQUIRED)
+
+    def requests_received(self, certificate, host, ca_certs_file, verify=True):
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        context.load_cert_chain(os.path.join(CERTS, certificate))
+        server_names, received = [], []
+        context.sni_callback = lambda tls, server_name, _: server_names.append(server_name)
+        listener = socket.socket()
+        listener.settimeout(5)
+        listener.bind(('127.0.0.1', 0))
+        listener.listen(1)
+
+        def serve():
+            with listener:
+                try:
+                    with listener.accept()[0] as client, context.wrap_socket(client, server_side=True) as tls:
+                        if tls.recv(1):
+                            received.append(server_names[-1])
+                except OSError:
+                    pass
+
+        server = threading.Thread(target=serve)
+        server.start()
+        with patch.multiple(config, LDAP_SERVER=f'ldaps://{host}:{listener.getsockname()[1]}',
+                            LDAP_CA_CERTS_FILE=ca_certs_file and os.path.join(CERTS, ca_certs_file),
+                            LDAP_TLS_VERIFY=verify, LDAP_USERNAME='', LDAP_PASSWORD='', NETWORK_TIMEOUT=5):
+            with self.assertRaises(LDAPException):
+                watchdog.retrieve_ldap()
+        server.join()
+        return received
+
+    def test_certificate_is_verified_for_dns_names_and_ip_addresses(self):
+        for host, server_name in (('localhost', 'localhost'), ('127.0.0.1', None)):
+            with self.subTest(host=host):
+                self.assertEqual(self.requests_received('localhost.pem', host, 'localhost.pem'), [server_name])
+
+    def test_mismatched_or_untrusted_certificates_are_rejected(self):
+        for certificate, host, ca_certs_file in (
+            ('ldap.example.com.pem', 'localhost', 'ldap.example.com.pem'),
+            ('ldap.example.com.pem', '127.0.0.1', 'ldap.example.com.pem'),
+            ('localhost.pem', 'localhost', None),
+        ):
+            with self.subTest(certificate=certificate, host=host, ca_certs_file=ca_certs_file):
+                self.assertEqual(self.requests_received(certificate, host, ca_certs_file), [])
+
+    def test_verification_can_be_turned_off(self):
+        for certificate, host in (('ldap.example.com.pem', 'localhost'), ('localhost.pem', '127.0.0.1')):
+            with self.subTest(certificate=certificate, host=host):
+                self.assertEqual(len(self.requests_received(certificate, host, None, verify=False)), 1)
+
+
+class NetworkTests(unittest.TestCase):
+    def test_ldap_waits_are_bounded_for_authenticated_and_anonymous_binds(self):
+        for username, password in (('', ''), ('alice', 'password')):
+            with self.subTest(authenticated=bool(username)):
+                connection = Mock()
+                connection.bind.return_value = False
+                with patch.multiple(config, LDAP_SERVER='localhost', LDAP_CA_CERTS_FILE=None,
+                                    LDAP_USERNAME=username, LDAP_PASSWORD=password, NETWORK_TIMEOUT=7), \
+                        patch.object(watchdog, 'Connection', return_value=connection) as factory:
+                    with self.assertRaises(LDAPException):
+                        watchdog.retrieve_ldap()
+                self.assertEqual(factory.call_args[0][0].connect_timeout, 7)
+                self.assertEqual(factory.call_args[1]['receive_timeout'], 7)
+
+    def test_slack_failures_are_reported_without_losing_console_output(self):
+        response = requests.Response()
+        response.status_code = 429
+        response.url = 'https://example.invalid/secret-webhook'
+        for failure in (response, requests.ConnectionError('secret-webhook')):
+            with self.subTest(failure=type(failure).__name__):
+                output, errors = io.StringIO(), io.StringIO()
+                with patch.multiple(config, SLACK_WEBHOOK=response.url, NETWORK_TIMEOUT=7), \
+                        patch.object(watchdog, 'requests', requests, create=True), \
+                        patch.object(requests, 'post') as post, \
+                        redirect_stdout(output), redirect_stderr(errors):
+                    if isinstance(failure, Exception):
+                        post.side_effect = failure
+                    else:
+                        post.return_value = failure
+                    watchdog.announce(DN, 'add', {'cn': ['Alice']})
+                self.assertIn('Alice', output.getvalue())
+                self.assertIn('Slack notification failed', errors.getvalue())
+                self.assertIn('ConnectionError' if isinstance(failure, Exception) else 'HTTP 429', errors.getvalue())
+                self.assertNotIn('secret-webhook', errors.getvalue())
+                self.assertEqual(post.call_args[1]['timeout'], 7)

ldap_monitor-1.0.0/LDAP_Monitor.egg-info/requires.txt

@@ -1,4 +0,0 @@
-ldap3
-
-[slack]
-requests